SnowPro Advanced: Security Engineer Question 264
Select 2A Snowflake security engineer is asked to detect possible brute-force attempts and unauthorized access against user accounts in near real time. The company wants to use native Snowflake capabilities first, but also wants the option to forward findings to its enterprise SIEM for correlation with VPN and IdP logs. Which TWO actions provide the most appropriate solution?
- A
Query Snowflake login history for repeated failed login attempts, unusual client IP addresses, and impossible-travel patterns, and use this as the basis for alerting logic.
- B
Use Snowflake Trust Center to review security posture signals and combine that with external monitoring by exporting or integrating relevant account activity into the company SIEM.
- C
Monitor QUERY_HISTORY for repeated compilation errors because this is the primary source for detecting failed authentication attempts.
- D
Rely only on network policy allowlists because failed login monitoring is unnecessary when IP restrictions are configured.
- E
Create a process that reviews login activity manually or on a schedule and correlates Snowflake authentication events with external identity and network telemetry.
Show answer and explanation
Correct answers: A, E
Explanation
The best answer focuses on the correct event source and realistic operational workflow. In Snowflake, authentication anomaly detection is based on login history data, not query execution history. Security teams commonly inspect failed login attempts, source IPs, client metadata, and timing patterns to identify brute-force attacks or unauthorized access attempts. This can be done manually with SQL queries or operationalized through scheduled checks and alerts. Correlating Snowflake authentication events with external sources such as IdP, VPN, and SIEM data is a strong best practice because it provides broader context for investigations. Trust Center can support security visibility and posture review, but candidates should not confuse it with the core authentication-event telemetry source. Snowflake documentation on login history/account usage and security monitoring practices supports using login-related views/functions for authentication analysis and integrating with external monitoring workflows where needed.
- A. Correct.
Correct. Snowflake exposes login activity through account usage and related login history views/functions, which are the appropriate native sources for detecting authentication anomalies. Repeated failed logins can indicate brute-force behavior, and reviewing source IPs, users, client applications, and timing can help identify unauthorized access attempts. In practice, organizations often build scheduled queries, dashboards, or alerts on top of login history data.
- B. Incorrect.
Incorrect. Trust Center is useful for reviewing security-related information and posture, but it is not the primary mechanism described for exporting detailed authentication findings into a SIEM for custom brute-force analytics. The stronger exam-relevant pattern is to use Snowflake login history as the event source and correlate those events with external telemetry. This option overstates Trust Center as the central operational detection workflow.
- C. Incorrect.
Incorrect. QUERY_HISTORY is for SQL statement execution and troubleshooting query activity, not for authentication monitoring. Failed login attempts occur before a session is established and therefore are not primarily tracked in query history. This is a common misconception when candidates confuse session activity monitoring with authentication event monitoring.
- D. Incorrect.
Incorrect. Network policies reduce exposure by restricting access from approved IP ranges, but they do not eliminate the need to monitor authentication events. Attackers may still attempt logins from allowed networks, compromised devices, or misconfigured ranges. Best practice is defense in depth: preventive controls plus monitoring and alerting.
- E. Correct.
Correct. This reflects a practical and realistic security operations approach. Snowflake login activity should be reviewed either manually or automatically, and the results should be correlated with identity provider logs, VPN logs, and other network telemetry in an external tool such as a SIEM. This improves detection of suspicious patterns such as credential stuffing, anomalous geolocation changes, or access attempts from unexpected environments.